blob: a1d71e1b3d24540622a365a4b9544d2fa1552f1b [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSL client with certificate authentication
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000029#include "mbedtls/platform.h"
Rich Evansf90016a2015-01-19 14:26:37 +000030#else
Rich Evans18b78c72015-02-11 14:06:19 +000031#include <stdio.h>
Simon Butcherd3138c32016-04-27 01:26:50 +010032#include <stdlib.h>
33#define mbedtls_time time
34#define mbedtls_time_t time_t
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020035#define mbedtls_printf printf
36#define mbedtls_fprintf fprintf
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020037#define mbedtls_snprintf snprintf
Rich Evansf90016a2015-01-19 14:26:37 +000038#endif
39
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +020040#if !defined(MBEDTLS_ENTROPY_C) || \
41 !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_CLI_C) || \
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +020042 !defined(MBEDTLS_NET_C) || !defined(MBEDTLS_CTR_DRBG_C)
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +020043int main( void )
44{
45 mbedtls_printf("MBEDTLS_ENTROPY_C and/or "
46 "MBEDTLS_SSL_TLS_C and/or MBEDTLS_SSL_CLI_C and/or "
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +020047 "MBEDTLS_NET_C and/or MBEDTLS_CTR_DRBG_C and/or not defined.\n");
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +020048 return( 0 );
49}
50#else
51
Andres AG788aa4a2016-09-14 14:32:09 +010052#include "mbedtls/net_sockets.h"
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000053#include "mbedtls/ssl.h"
54#include "mbedtls/entropy.h"
55#include "mbedtls/ctr_drbg.h"
56#include "mbedtls/certs.h"
57#include "mbedtls/x509.h"
58#include "mbedtls/error.h"
59#include "mbedtls/debug.h"
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +020060#include "mbedtls/timing.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000061
Rich Evans18b78c72015-02-11 14:06:19 +000062#include <stdio.h>
63#include <stdlib.h>
64#include <string.h>
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +010065
Paul Bakker9caf2d22010-02-18 19:37:19 +000066#define DFL_SERVER_NAME "localhost"
Manuel Pégourié-Gonnard0d8780b2014-02-25 11:11:26 +010067#define DFL_SERVER_ADDR NULL
Manuel Pégourié-Gonnardc0d74942015-06-23 12:30:57 +020068#define DFL_SERVER_PORT "4433"
Paul Bakker9caf2d22010-02-18 19:37:19 +000069#define DFL_REQUEST_PAGE "/"
Manuel Pégourié-Gonnarddea29c52014-06-18 13:07:56 +020070#define DFL_REQUEST_SIZE -1
Paul Bakker9caf2d22010-02-18 19:37:19 +000071#define DFL_DEBUG_LEVEL 0
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +010072#define DFL_NBIO 0
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +020073#define DFL_READ_TIMEOUT 0
Manuel Pégourié-Gonnardf1e0df32014-10-02 14:02:32 +020074#define DFL_MAX_RESEND 0
Paul Bakker5690efc2011-05-26 13:16:06 +000075#define DFL_CA_FILE ""
Paul Bakker8d914582012-06-04 12:46:42 +000076#define DFL_CA_PATH ""
Paul Bakker67968392010-07-18 08:28:20 +000077#define DFL_CRT_FILE ""
78#define DFL_KEY_FILE ""
Paul Bakkerd4a56ec2013-04-16 18:05:29 +020079#define DFL_PSK ""
80#define DFL_PSK_IDENTITY "Client_identity"
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +020081#define DFL_ECJPAKE_PW NULL
Paul Bakker51936882011-02-20 16:05:58 +000082#define DFL_FORCE_CIPHER 0
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083#define DFL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION_DISABLED
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +010084#define DFL_ALLOW_LEGACY -2
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +010085#define DFL_RENEGOTIATE 0
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +020086#define DFL_EXCHANGES 1
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +020087#define DFL_MIN_VERSION -1
Paul Bakker1d29fb52012-09-28 13:28:45 +000088#define DFL_MAX_VERSION -1
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +000089#define DFL_ARC4 -1
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +010090#define DFL_AUTH_MODE -1
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020091#define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE
Manuel Pégourié-Gonnard265fe992015-01-09 12:43:35 +010092#define DFL_TRUNC_HMAC -1
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +010093#define DFL_RECSPLIT -1
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +020094#define DFL_DHMLEN -1
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +020095#define DFL_RECONNECT 0
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +010096#define DFL_RECO_DELAY 0
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +020097#define DFL_RECONNECT_HARD 0
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098#define DFL_TICKETS MBEDTLS_SSL_SESSION_TICKETS_ENABLED
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +020099#define DFL_ALPN_STRING NULL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200100#define DFL_TRANSPORT MBEDTLS_SSL_TRANSPORT_STREAM
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200101#define DFL_HS_TO_MIN 0
102#define DFL_HS_TO_MAX 0
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200103#define DFL_FALLBACK -1
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200104#define DFL_EXTENDED_MS -1
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100105#define DFL_ETM -1
Paul Bakker0e6975b2009-02-10 22:19:10 +0000106
Paul Bakker93c32b22014-04-25 13:40:05 +0200107#define GET_REQUEST "GET %s HTTP/1.0\r\nExtra-header: "
108#define GET_REQUEST_END "\r\n\r\n"
Paul Bakker5121ce52009-01-03 21:22:43 +0000109
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200110#if defined(MBEDTLS_X509_CRT_PARSE_C)
111#if defined(MBEDTLS_FS_IO)
Paul Bakker5690efc2011-05-26 13:16:06 +0000112#define USAGE_IO \
Paul Bakker1f9d02d2012-11-20 10:30:55 +0100113 " ca_file=%%s The single file containing the top-level CA(s) you fully trust\n" \
114 " default: \"\" (pre-loaded)\n" \
115 " ca_path=%%s The path containing the top-level CA(s) you fully trust\n" \
116 " default: \"\" (pre-loaded) (overrides ca_file)\n" \
117 " crt_file=%%s Your own cert and chain (in bottom to top order, top may be omitted)\n" \
118 " default: \"\" (pre-loaded)\n" \
Paul Bakker5690efc2011-05-26 13:16:06 +0000119 " key_file=%%s default: \"\" (pre-loaded)\n"
120#else
121#define USAGE_IO \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200122 " No file operations available (MBEDTLS_FS_IO not defined)\n"
123#endif /* MBEDTLS_FS_IO */
Paul Bakkered27a042013-04-18 22:46:23 +0200124#else
125#define USAGE_IO ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200126#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakkered27a042013-04-18 22:46:23 +0200127
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Paul Bakkered27a042013-04-18 22:46:23 +0200129#define USAGE_PSK \
130 " psk=%%s default: \"\" (in hex, without 0x)\n" \
131 " psk_identity=%%s default: \"Client_identity\"\n"
132#else
133#define USAGE_PSK ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200134#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakker5690efc2011-05-26 13:16:06 +0000135
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200136#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Paul Bakkera503a632013-08-14 13:48:06 +0200137#define USAGE_TICKETS \
138 " tickets=%%d default: 1 (enabled)\n"
139#else
140#define USAGE_TICKETS ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200141#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Paul Bakkera503a632013-08-14 13:48:06 +0200142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200143#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Paul Bakker1f2bc622013-08-15 13:45:55 +0200144#define USAGE_TRUNC_HMAC \
Manuel Pégourié-Gonnard265fe992015-01-09 12:43:35 +0100145 " trunc_hmac=%%d default: library default\n"
Paul Bakker1f2bc622013-08-15 13:45:55 +0200146#else
147#define USAGE_TRUNC_HMAC ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200148#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Paul Bakker1f2bc622013-08-15 13:45:55 +0200149
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200150#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Paul Bakker05decb22013-08-15 13:33:48 +0200151#define USAGE_MAX_FRAG_LEN \
152 " max_frag_len=%%d default: 16384 (tls default)\n" \
153 " options: 512, 1024, 2048, 4096\n"
154#else
155#define USAGE_MAX_FRAG_LEN ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200156#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Paul Bakker05decb22013-08-15 13:33:48 +0200157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200158#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +0100159#define USAGE_RECSPLIT \
Manuel Pégourié-Gonnardbf27eaa2015-06-11 17:02:10 +0200160 " recsplit=0/1 default: (library default: on)\n"
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +0100161#else
162#define USAGE_RECSPLIT
163#endif
164
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +0200165#if defined(MBEDTLS_DHM_C)
166#define USAGE_DHMLEN \
167 " dhmlen=%%d default: (library default: 1024 bits)\n"
168#else
169#define USAGE_DHMLEN
170#endif
171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200173#define USAGE_ALPN \
174 " alpn=%%s default: \"\" (disabled)\n" \
175 " example: spdy/1,http/1.1\n"
176#else
177#define USAGE_ALPN ""
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200178#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200180#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200181#define USAGE_DTLS \
182 " dtls=%%d default: 0 (TLS)\n" \
183 " hs_timeout=%%d-%%d default: (library default: 1000-60000)\n" \
184 " range of DTLS handshake timeouts in millisecs\n"
185#else
186#define USAGE_DTLS ""
187#endif
188
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200189#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200190#define USAGE_FALLBACK \
191 " fallback=0/1 default: (library default: off)\n"
192#else
193#define USAGE_FALLBACK ""
194#endif
195
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200196#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200197#define USAGE_EMS \
198 " extended_ms=0/1 default: (library default: on)\n"
199#else
200#define USAGE_EMS ""
201#endif
202
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100204#define USAGE_ETM \
205 " etm=0/1 default: (library default: on)\n"
206#else
207#define USAGE_ETM ""
208#endif
209
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200210#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100211#define USAGE_RENEGO \
212 " renegotiation=%%d default: 0 (disabled)\n" \
213 " renegotiate=%%d default: 0 (disabled)\n"
214#else
215#define USAGE_RENEGO ""
216#endif
217
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +0200218#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
219#define USAGE_ECJPAKE \
220 " ecjpake_pw=%%s default: none (disabled)\n"
221#else
222#define USAGE_ECJPAKE ""
223#endif
224
Paul Bakker9caf2d22010-02-18 19:37:19 +0000225#define USAGE \
Paul Bakker67968392010-07-18 08:28:20 +0000226 "\n usage: ssl_client2 param=<>...\n" \
227 "\n acceptable parameters:\n" \
228 " server_name=%%s default: localhost\n" \
Manuel Pégourié-Gonnard0d8780b2014-02-25 11:11:26 +0100229 " server_addr=%%s default: given by name\n" \
Paul Bakker67968392010-07-18 08:28:20 +0000230 " server_port=%%d default: 4433\n" \
Paul Bakker67968392010-07-18 08:28:20 +0000231 " request_page=%%s default: \".\"\n" \
Manuel Pégourié-Gonnarddea29c52014-06-18 13:07:56 +0200232 " request_size=%%d default: about 34 (basic request)\n" \
233 " (minimum: 0, max: 16384)\n" \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100234 " debug_level=%%d default: 0 (disabled)\n" \
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +0100235 " nbio=%%d default: 0 (blocking I/O)\n" \
236 " options: 1 (non-blocking), 2 (added delays)\n" \
Manuel Pégourié-Gonnard22311ae2015-09-09 11:22:58 +0200237 " read_timeout=%%d default: 0 ms (no timeout)\n" \
Manuel Pégourié-Gonnardf1e0df32014-10-02 14:02:32 +0200238 " max_resend=%%d default: 0 (no resend on timeout)\n" \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100239 "\n" \
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200240 USAGE_DTLS \
241 "\n" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +0100242 " auth_mode=%%s default: (library default: none)\n" \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100243 " options: none, optional, required\n" \
244 USAGE_IO \
245 "\n" \
246 USAGE_PSK \
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +0200247 USAGE_ECJPAKE \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100248 "\n" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100249 " allow_legacy=%%d default: (library default: no)\n" \
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100250 USAGE_RENEGO \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200251 " exchanges=%%d default: 1\n" \
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +0200252 " reconnect=%%d default: 0 (disabled)\n" \
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +0200253 " reco_delay=%%d default: 0 seconds\n" \
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +0200254 " reconnect_hard=%%d default: 0 (disabled)\n" \
Paul Bakkera503a632013-08-14 13:48:06 +0200255 USAGE_TICKETS \
Manuel Pégourié-Gonnard2fc243d2014-02-19 18:22:59 +0100256 USAGE_MAX_FRAG_LEN \
257 USAGE_TRUNC_HMAC \
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200258 USAGE_ALPN \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200259 USAGE_FALLBACK \
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200260 USAGE_EMS \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100261 USAGE_ETM \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +0100262 USAGE_RECSPLIT \
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +0200263 USAGE_DHMLEN \
Paul Bakker1d29fb52012-09-28 13:28:45 +0000264 "\n" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +0100265 " arc4=%%d default: (library default: 0)\n" \
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +0200266 " min_version=%%s default: (library default: tls1)\n" \
267 " max_version=%%s default: (library default: tls1_2)\n" \
Paul Bakker1d29fb52012-09-28 13:28:45 +0000268 " force_version=%%s default: \"\" (none)\n" \
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100269 " options: ssl3, tls1, tls1_1, tls1_2, dtls1, dtls1_2\n" \
Paul Bakker1d29fb52012-09-28 13:28:45 +0000270 "\n" \
Paul Bakker51936882011-02-20 16:05:58 +0000271 " force_ciphersuite=<name> default: all enabled\n"\
272 " acceptable ciphersuite names:\n"
Paul Bakker9caf2d22010-02-18 19:37:19 +0000273
Rich Evans85b05ec2015-02-12 11:37:29 +0000274/*
275 * global options
276 */
277struct options
278{
279 const char *server_name; /* hostname of the server (client only) */
280 const char *server_addr; /* address of the server (client only) */
Manuel Pégourié-Gonnardc0d74942015-06-23 12:30:57 +0200281 const char *server_port; /* port on which the ssl service runs */
Rich Evans85b05ec2015-02-12 11:37:29 +0000282 int debug_level; /* level of debugging */
283 int nbio; /* should I/O be blocking? */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200284 uint32_t read_timeout; /* timeout on mbedtls_ssl_read() in milliseconds */
Manuel Pégourié-Gonnardd901d172015-02-16 18:37:53 +0000285 int max_resend; /* DTLS times to resend on read timeout */
Rich Evans85b05ec2015-02-12 11:37:29 +0000286 const char *request_page; /* page on server to request */
287 int request_size; /* pad request with header to requested size */
288 const char *ca_file; /* the file with the CA certificate(s) */
289 const char *ca_path; /* the path with the CA certificate(s) reside */
290 const char *crt_file; /* the file with the client certificate */
291 const char *key_file; /* the file with the client key */
292 const char *psk; /* the pre-shared key */
293 const char *psk_identity; /* the pre-shared key identity */
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +0200294 const char *ecjpake_pw; /* the EC J-PAKE password */
Rich Evans85b05ec2015-02-12 11:37:29 +0000295 int force_ciphersuite[2]; /* protocol/ciphersuite to use, or all */
296 int renegotiation; /* enable / disable renegotiation */
297 int allow_legacy; /* allow legacy renegotiation */
298 int renegotiate; /* attempt renegotiation? */
299 int renego_delay; /* delay before enforcing renegotiation */
300 int exchanges; /* number of data exchanges */
301 int min_version; /* minimum protocol version accepted */
302 int max_version; /* maximum protocol version accepted */
303 int arc4; /* flag for arc4 suites support */
304 int auth_mode; /* verify mode for connection */
305 unsigned char mfl_code; /* code for maximum fragment length */
306 int trunc_hmac; /* negotiate truncated hmac or not */
307 int recsplit; /* enable record splitting? */
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +0200308 int dhmlen; /* minimum DHM params len in bits */
Rich Evans85b05ec2015-02-12 11:37:29 +0000309 int reconnect; /* attempt to resume session */
310 int reco_delay; /* delay in seconds before resuming session */
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +0200311 int reconnect_hard; /* unexpectedly reconnect from the same port */
Rich Evans85b05ec2015-02-12 11:37:29 +0000312 int tickets; /* enable / disable session tickets */
313 const char *alpn_string; /* ALPN supported protocols */
Manuel Pégourié-Gonnardd901d172015-02-16 18:37:53 +0000314 int transport; /* TLS or DTLS? */
315 uint32_t hs_to_min; /* Initial value of DTLS handshake timer */
316 uint32_t hs_to_max; /* Max value of DTLS handshake timer */
Rich Evans85b05ec2015-02-12 11:37:29 +0000317 int fallback; /* is this a fallback connection? */
318 int extended_ms; /* negotiate extended master secret? */
319 int etm; /* negotiate encrypt then mac? */
320} opt;
321
Manuel Pégourié-Gonnard61ee3512015-06-23 17:35:03 +0200322static void my_debug( void *ctx, int level,
323 const char *file, int line,
324 const char *str )
Rich Evans85b05ec2015-02-12 11:37:29 +0000325{
Manuel Pégourié-Gonnard052f2882015-07-01 11:50:23 +0200326 const char *p, *basename;
Rich Evans85b05ec2015-02-12 11:37:29 +0000327
Manuel Pégourié-Gonnard052f2882015-07-01 11:50:23 +0200328 /* Extract basename from file */
329 for( p = basename = file; *p != '\0'; p++ )
330 if( *p == '/' || *p == '\\' )
331 basename = p + 1;
332
333 mbedtls_fprintf( (FILE *) ctx, "%s:%04d: |%d| %s", basename, line, level, str );
Rich Evans85b05ec2015-02-12 11:37:29 +0000334 fflush( (FILE *) ctx );
335}
336
337/*
338 * Test recv/send functions that make sure each try returns
339 * WANT_READ/WANT_WRITE at least once before sucesseding
340 */
341static int my_recv( void *ctx, unsigned char *buf, size_t len )
342{
343 static int first_try = 1;
344 int ret;
345
346 if( first_try )
347 {
348 first_try = 0;
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +0100349 return( MBEDTLS_ERR_SSL_WANT_READ );
Rich Evans85b05ec2015-02-12 11:37:29 +0000350 }
351
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 ret = mbedtls_net_recv( ctx, buf, len );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +0100353 if( ret != MBEDTLS_ERR_SSL_WANT_READ )
Rich Evans85b05ec2015-02-12 11:37:29 +0000354 first_try = 1; /* Next call will be a new operation */
355 return( ret );
356}
357
358static int my_send( void *ctx, const unsigned char *buf, size_t len )
359{
360 static int first_try = 1;
361 int ret;
362
363 if( first_try )
364 {
365 first_try = 0;
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +0100366 return( MBEDTLS_ERR_SSL_WANT_WRITE );
Rich Evans85b05ec2015-02-12 11:37:29 +0000367 }
368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200369 ret = mbedtls_net_send( ctx, buf, len );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +0100370 if( ret != MBEDTLS_ERR_SSL_WANT_WRITE )
Rich Evans85b05ec2015-02-12 11:37:29 +0000371 first_try = 1; /* Next call will be a new operation */
372 return( ret );
373}
374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200375#if defined(MBEDTLS_X509_CRT_PARSE_C)
Rich Evans85b05ec2015-02-12 11:37:29 +0000376/*
377 * Enabled if debug_level > 1 in code below
378 */
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200379static int my_verify( void *data, mbedtls_x509_crt *crt, int depth, uint32_t *flags )
Rich Evans85b05ec2015-02-12 11:37:29 +0000380{
381 char buf[1024];
382 ((void) data);
383
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200384 mbedtls_printf( "\nVerify requested for (Depth %d):\n", depth );
385 mbedtls_x509_crt_info( buf, sizeof( buf ) - 1, "", crt );
386 mbedtls_printf( "%s", buf );
Rich Evans85b05ec2015-02-12 11:37:29 +0000387
Rich Evans85b05ec2015-02-12 11:37:29 +0000388 if ( ( *flags ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200389 mbedtls_printf( " This certificate has no flags\n" );
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +0100390 else
391 {
392 mbedtls_x509_crt_verify_info( buf, sizeof( buf ), " ! ", *flags );
393 mbedtls_printf( "%s\n", buf );
394 }
Rich Evans85b05ec2015-02-12 11:37:29 +0000395
396 return( 0 );
397}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200398#endif /* MBEDTLS_X509_CRT_PARSE_C */
Rich Evans85b05ec2015-02-12 11:37:29 +0000399
Paul Bakker9caf2d22010-02-18 19:37:19 +0000400int main( int argc, char *argv[] )
Paul Bakker5121ce52009-01-03 21:22:43 +0000401{
Manuel Pégourié-Gonnard5db64322015-06-30 15:40:39 +0200402 int ret = 0, len, tail_len, i, written, frags, retry_left;
403 mbedtls_net_context server_fd;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200404 unsigned char buf[MBEDTLS_SSL_MAX_CONTENT_LEN + 1];
405#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
406 unsigned char psk[MBEDTLS_PSK_MAX_LEN];
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200407 size_t psk_len = 0;
Paul Bakkered27a042013-04-18 22:46:23 +0200408#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200409#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200410 const char *alpn_list[10];
411#endif
Paul Bakkeref3f8c72013-06-24 13:01:08 +0200412 const char *pers = "ssl_client2";
Paul Bakker508ad5a2011-12-04 17:09:26 +0000413
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200414 mbedtls_entropy_context entropy;
415 mbedtls_ctr_drbg_context ctr_drbg;
416 mbedtls_ssl_context ssl;
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200417 mbedtls_ssl_config conf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200418 mbedtls_ssl_session saved_session;
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +0200419#if defined(MBEDTLS_TIMING_C)
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +0200420 mbedtls_timing_delay_context timer;
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +0200421#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnarddb1cc762015-05-12 11:27:25 +0200423 uint32_t flags;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200424 mbedtls_x509_crt cacert;
425 mbedtls_x509_crt clicert;
426 mbedtls_pk_context pkey;
Paul Bakkered27a042013-04-18 22:46:23 +0200427#endif
Paul Bakker9caf2d22010-02-18 19:37:19 +0000428 char *p, *q;
Paul Bakker51936882011-02-20 16:05:58 +0000429 const int *list;
Paul Bakker9caf2d22010-02-18 19:37:19 +0000430
Paul Bakker1a207ec2011-02-06 13:22:40 +0000431 /*
432 * Make sure memory references are valid.
433 */
Manuel Pégourié-Gonnard5db64322015-06-30 15:40:39 +0200434 mbedtls_net_init( &server_fd );
Manuel Pégourié-Gonnard41d479e2015-04-29 00:48:22 +0200435 mbedtls_ssl_init( &ssl );
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +0200436 mbedtls_ssl_config_init( &conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200437 memset( &saved_session, 0, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnardec160c02015-04-28 22:52:30 +0200438 mbedtls_ctr_drbg_init( &ctr_drbg );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200439#if defined(MBEDTLS_X509_CRT_PARSE_C)
440 mbedtls_x509_crt_init( &cacert );
441 mbedtls_x509_crt_init( &clicert );
442 mbedtls_pk_init( &pkey );
Paul Bakkered27a042013-04-18 22:46:23 +0200443#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200444#if defined(MBEDTLS_SSL_ALPN)
Paul Bakker525f8752014-05-01 10:58:57 +0200445 memset( (void * ) alpn_list, 0, sizeof( alpn_list ) );
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200446#endif
Paul Bakker1a207ec2011-02-06 13:22:40 +0000447
Paul Bakker9caf2d22010-02-18 19:37:19 +0000448 if( argc == 0 )
449 {
450 usage:
Paul Bakkerfab5c822012-02-06 16:45:10 +0000451 if( ret == 0 )
452 ret = 1;
453
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200454 mbedtls_printf( USAGE );
Paul Bakker51936882011-02-20 16:05:58 +0000455
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200456 list = mbedtls_ssl_list_ciphersuites();
Paul Bakker51936882011-02-20 16:05:58 +0000457 while( *list )
458 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 mbedtls_printf(" %-42s", mbedtls_ssl_get_ciphersuite_name( *list ) );
Paul Bakkered27a042013-04-18 22:46:23 +0200460 list++;
461 if( !*list )
462 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200463 mbedtls_printf(" %s\n", mbedtls_ssl_get_ciphersuite_name( *list ) );
Paul Bakker51936882011-02-20 16:05:58 +0000464 list++;
465 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200466 mbedtls_printf("\n");
Paul Bakker9caf2d22010-02-18 19:37:19 +0000467 goto exit;
468 }
469
470 opt.server_name = DFL_SERVER_NAME;
Manuel Pégourié-Gonnard0d8780b2014-02-25 11:11:26 +0100471 opt.server_addr = DFL_SERVER_ADDR;
Paul Bakker9caf2d22010-02-18 19:37:19 +0000472 opt.server_port = DFL_SERVER_PORT;
473 opt.debug_level = DFL_DEBUG_LEVEL;
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +0100474 opt.nbio = DFL_NBIO;
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +0200475 opt.read_timeout = DFL_READ_TIMEOUT;
Manuel Pégourié-Gonnardf1e0df32014-10-02 14:02:32 +0200476 opt.max_resend = DFL_MAX_RESEND;
Paul Bakker9caf2d22010-02-18 19:37:19 +0000477 opt.request_page = DFL_REQUEST_PAGE;
Paul Bakker93c32b22014-04-25 13:40:05 +0200478 opt.request_size = DFL_REQUEST_SIZE;
Paul Bakker5690efc2011-05-26 13:16:06 +0000479 opt.ca_file = DFL_CA_FILE;
Paul Bakker8d914582012-06-04 12:46:42 +0000480 opt.ca_path = DFL_CA_PATH;
Paul Bakker67968392010-07-18 08:28:20 +0000481 opt.crt_file = DFL_CRT_FILE;
482 opt.key_file = DFL_KEY_FILE;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200483 opt.psk = DFL_PSK;
484 opt.psk_identity = DFL_PSK_IDENTITY;
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +0200485 opt.ecjpake_pw = DFL_ECJPAKE_PW;
Paul Bakker51936882011-02-20 16:05:58 +0000486 opt.force_ciphersuite[0]= DFL_FORCE_CIPHER;
Paul Bakker48916f92012-09-16 19:57:18 +0000487 opt.renegotiation = DFL_RENEGOTIATION;
488 opt.allow_legacy = DFL_ALLOW_LEGACY;
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100489 opt.renegotiate = DFL_RENEGOTIATE;
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200490 opt.exchanges = DFL_EXCHANGES;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000491 opt.min_version = DFL_MIN_VERSION;
492 opt.max_version = DFL_MAX_VERSION;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100493 opt.arc4 = DFL_ARC4;
Paul Bakker91ebfb52012-11-23 14:04:08 +0100494 opt.auth_mode = DFL_AUTH_MODE;
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +0200495 opt.mfl_code = DFL_MFL_CODE;
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +0200496 opt.trunc_hmac = DFL_TRUNC_HMAC;
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +0100497 opt.recsplit = DFL_RECSPLIT;
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +0200498 opt.dhmlen = DFL_DHMLEN;
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +0200499 opt.reconnect = DFL_RECONNECT;
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100500 opt.reco_delay = DFL_RECO_DELAY;
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +0200501 opt.reconnect_hard = DFL_RECONNECT_HARD;
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200502 opt.tickets = DFL_TICKETS;
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200503 opt.alpn_string = DFL_ALPN_STRING;
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200504 opt.transport = DFL_TRANSPORT;
505 opt.hs_to_min = DFL_HS_TO_MIN;
506 opt.hs_to_max = DFL_HS_TO_MAX;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200507 opt.fallback = DFL_FALLBACK;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200508 opt.extended_ms = DFL_EXTENDED_MS;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100509 opt.etm = DFL_ETM;
Paul Bakker9caf2d22010-02-18 19:37:19 +0000510
511 for( i = 1; i < argc; i++ )
512 {
Paul Bakker9caf2d22010-02-18 19:37:19 +0000513 p = argv[i];
514 if( ( q = strchr( p, '=' ) ) == NULL )
515 goto usage;
516 *q++ = '\0';
517
518 if( strcmp( p, "server_name" ) == 0 )
519 opt.server_name = q;
Manuel Pégourié-Gonnard0d8780b2014-02-25 11:11:26 +0100520 else if( strcmp( p, "server_addr" ) == 0 )
521 opt.server_addr = q;
Paul Bakker9caf2d22010-02-18 19:37:19 +0000522 else if( strcmp( p, "server_port" ) == 0 )
Manuel Pégourié-Gonnardc0d74942015-06-23 12:30:57 +0200523 opt.server_port = q;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100524 else if( strcmp( p, "dtls" ) == 0 )
525 {
526 int t = atoi( q );
527 if( t == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200528 opt.transport = MBEDTLS_SSL_TRANSPORT_STREAM;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100529 else if( t == 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200530 opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
Manuel Pégourié-Gonnarde29fd4b2014-02-06 14:02:55 +0100531 else
532 goto usage;
533 }
Paul Bakker9caf2d22010-02-18 19:37:19 +0000534 else if( strcmp( p, "debug_level" ) == 0 )
535 {
536 opt.debug_level = atoi( q );
537 if( opt.debug_level < 0 || opt.debug_level > 65535 )
538 goto usage;
539 }
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +0100540 else if( strcmp( p, "nbio" ) == 0 )
541 {
542 opt.nbio = atoi( q );
543 if( opt.nbio < 0 || opt.nbio > 2 )
544 goto usage;
545 }
Manuel Pégourié-Gonnard6b651412014-10-01 18:29:03 +0200546 else if( strcmp( p, "read_timeout" ) == 0 )
547 opt.read_timeout = atoi( q );
Manuel Pégourié-Gonnardf1e0df32014-10-02 14:02:32 +0200548 else if( strcmp( p, "max_resend" ) == 0 )
549 {
550 opt.max_resend = atoi( q );
551 if( opt.max_resend < 0 )
552 goto usage;
553 }
Paul Bakker9caf2d22010-02-18 19:37:19 +0000554 else if( strcmp( p, "request_page" ) == 0 )
555 opt.request_page = q;
Paul Bakker93c32b22014-04-25 13:40:05 +0200556 else if( strcmp( p, "request_size" ) == 0 )
557 {
558 opt.request_size = atoi( q );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200559 if( opt.request_size < 0 || opt.request_size > MBEDTLS_SSL_MAX_CONTENT_LEN )
Paul Bakker93c32b22014-04-25 13:40:05 +0200560 goto usage;
561 }
Paul Bakker5690efc2011-05-26 13:16:06 +0000562 else if( strcmp( p, "ca_file" ) == 0 )
563 opt.ca_file = q;
Paul Bakker8d914582012-06-04 12:46:42 +0000564 else if( strcmp( p, "ca_path" ) == 0 )
565 opt.ca_path = q;
Paul Bakker67968392010-07-18 08:28:20 +0000566 else if( strcmp( p, "crt_file" ) == 0 )
567 opt.crt_file = q;
568 else if( strcmp( p, "key_file" ) == 0 )
569 opt.key_file = q;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200570 else if( strcmp( p, "psk" ) == 0 )
571 opt.psk = q;
572 else if( strcmp( p, "psk_identity" ) == 0 )
573 opt.psk_identity = q;
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +0200574 else if( strcmp( p, "ecjpake_pw" ) == 0 )
575 opt.ecjpake_pw = q;
Paul Bakker51936882011-02-20 16:05:58 +0000576 else if( strcmp( p, "force_ciphersuite" ) == 0 )
577 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200578 opt.force_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id( q );
Paul Bakker51936882011-02-20 16:05:58 +0000579
Manuel Pégourié-Gonnard8de259b2014-06-11 14:19:06 +0200580 if( opt.force_ciphersuite[0] == 0 )
Paul Bakkerfab5c822012-02-06 16:45:10 +0000581 {
582 ret = 2;
Paul Bakker51936882011-02-20 16:05:58 +0000583 goto usage;
Paul Bakkerfab5c822012-02-06 16:45:10 +0000584 }
Paul Bakker51936882011-02-20 16:05:58 +0000585 opt.force_ciphersuite[1] = 0;
586 }
Paul Bakker48916f92012-09-16 19:57:18 +0000587 else if( strcmp( p, "renegotiation" ) == 0 )
588 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589 opt.renegotiation = (atoi( q )) ? MBEDTLS_SSL_RENEGOTIATION_ENABLED :
590 MBEDTLS_SSL_RENEGOTIATION_DISABLED;
Paul Bakker48916f92012-09-16 19:57:18 +0000591 }
592 else if( strcmp( p, "allow_legacy" ) == 0 )
593 {
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100594 switch( atoi( q ) )
595 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596 case -1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE; break;
597 case 0: opt.allow_legacy = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION; break;
598 case 1: opt.allow_legacy = MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION; break;
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100599 default: goto usage;
600 }
Paul Bakker48916f92012-09-16 19:57:18 +0000601 }
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100602 else if( strcmp( p, "renegotiate" ) == 0 )
603 {
604 opt.renegotiate = atoi( q );
605 if( opt.renegotiate < 0 || opt.renegotiate > 1 )
606 goto usage;
607 }
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200608 else if( strcmp( p, "exchanges" ) == 0 )
609 {
610 opt.exchanges = atoi( q );
611 if( opt.exchanges < 1 )
612 goto usage;
613 }
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +0200614 else if( strcmp( p, "reconnect" ) == 0 )
615 {
616 opt.reconnect = atoi( q );
Manuel Pégourié-Gonnardcf2e97e2013-08-02 15:04:36 +0200617 if( opt.reconnect < 0 || opt.reconnect > 2 )
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +0200618 goto usage;
619 }
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100620 else if( strcmp( p, "reco_delay" ) == 0 )
621 {
622 opt.reco_delay = atoi( q );
623 if( opt.reco_delay < 0 )
624 goto usage;
625 }
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +0200626 else if( strcmp( p, "reconnect_hard" ) == 0 )
627 {
628 opt.reconnect_hard = atoi( q );
629 if( opt.reconnect_hard < 0 || opt.reconnect_hard > 1 )
630 goto usage;
631 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200632 else if( strcmp( p, "tickets" ) == 0 )
633 {
634 opt.tickets = atoi( q );
635 if( opt.tickets < 0 || opt.tickets > 2 )
636 goto usage;
637 }
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200638 else if( strcmp( p, "alpn" ) == 0 )
639 {
640 opt.alpn_string = q;
641 }
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200642 else if( strcmp( p, "fallback" ) == 0 )
643 {
644 switch( atoi( q ) )
645 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200646 case 0: opt.fallback = MBEDTLS_SSL_IS_NOT_FALLBACK; break;
647 case 1: opt.fallback = MBEDTLS_SSL_IS_FALLBACK; break;
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200648 default: goto usage;
649 }
650 }
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200651 else if( strcmp( p, "extended_ms" ) == 0 )
652 {
653 switch( atoi( q ) )
654 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200655 case 0: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_DISABLED; break;
656 case 1: opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; break;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200657 default: goto usage;
658 }
659 }
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100660 else if( strcmp( p, "etm" ) == 0 )
661 {
662 switch( atoi( q ) )
663 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200664 case 0: opt.etm = MBEDTLS_SSL_ETM_DISABLED; break;
665 case 1: opt.etm = MBEDTLS_SSL_ETM_ENABLED; break;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100666 default: goto usage;
667 }
668 }
Paul Bakker1d29fb52012-09-28 13:28:45 +0000669 else if( strcmp( p, "min_version" ) == 0 )
670 {
671 if( strcmp( q, "ssl3" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200672 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000673 else if( strcmp( q, "tls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100675 else if( strcmp( q, "tls1_1" ) == 0 ||
676 strcmp( q, "dtls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100678 else if( strcmp( q, "tls1_2" ) == 0 ||
679 strcmp( q, "dtls1_2" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200680 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000681 else
682 goto usage;
683 }
684 else if( strcmp( p, "max_version" ) == 0 )
685 {
686 if( strcmp( q, "ssl3" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200687 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000688 else if( strcmp( q, "tls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200689 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100690 else if( strcmp( q, "tls1_1" ) == 0 ||
691 strcmp( q, "dtls1" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200692 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2;
Manuel Pégourié-Gonnard83218f12014-02-12 11:11:12 +0100693 else if( strcmp( q, "tls1_2" ) == 0 ||
694 strcmp( q, "dtls1_2" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200695 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000696 else
697 goto usage;
698 }
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100699 else if( strcmp( p, "arc4" ) == 0 )
700 {
701 switch( atoi( q ) )
702 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200703 case 0: opt.arc4 = MBEDTLS_SSL_ARC4_DISABLED; break;
704 case 1: opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED; break;
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100705 default: goto usage;
706 }
707 }
Paul Bakker1d29fb52012-09-28 13:28:45 +0000708 else if( strcmp( p, "force_version" ) == 0 )
709 {
710 if( strcmp( q, "ssl3" ) == 0 )
711 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200712 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_0;
713 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_0;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000714 }
715 else if( strcmp( q, "tls1" ) == 0 )
716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200717 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_1;
718 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_1;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000719 }
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +0100720 else if( strcmp( q, "tls1_1" ) == 0 )
Paul Bakker1d29fb52012-09-28 13:28:45 +0000721 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200722 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
723 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000724 }
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +0100725 else if( strcmp( q, "tls1_2" ) == 0 )
Paul Bakker1d29fb52012-09-28 13:28:45 +0000726 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200727 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3;
728 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3;
Paul Bakker1d29fb52012-09-28 13:28:45 +0000729 }
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +0100730 else if( strcmp( q, "dtls1" ) == 0 )
731 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200732 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
733 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_2;
734 opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +0100735 }
736 else if( strcmp( q, "dtls1_2" ) == 0 )
737 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200738 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3;
739 opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3;
740 opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM;
Manuel Pégourié-Gonnardfe3f73b2014-03-26 12:16:44 +0100741 }
Paul Bakker1d29fb52012-09-28 13:28:45 +0000742 else
743 goto usage;
744 }
Paul Bakker91ebfb52012-11-23 14:04:08 +0100745 else if( strcmp( p, "auth_mode" ) == 0 )
746 {
747 if( strcmp( q, "none" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748 opt.auth_mode = MBEDTLS_SSL_VERIFY_NONE;
Paul Bakker91ebfb52012-11-23 14:04:08 +0100749 else if( strcmp( q, "optional" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200750 opt.auth_mode = MBEDTLS_SSL_VERIFY_OPTIONAL;
Paul Bakker91ebfb52012-11-23 14:04:08 +0100751 else if( strcmp( q, "required" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200752 opt.auth_mode = MBEDTLS_SSL_VERIFY_REQUIRED;
Paul Bakker91ebfb52012-11-23 14:04:08 +0100753 else
754 goto usage;
755 }
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +0200756 else if( strcmp( p, "max_frag_len" ) == 0 )
757 {
758 if( strcmp( q, "512" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200759 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_512;
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +0200760 else if( strcmp( q, "1024" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200761 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_1024;
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +0200762 else if( strcmp( q, "2048" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_2048;
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +0200764 else if( strcmp( q, "4096" ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200765 opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_4096;
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +0200766 else
767 goto usage;
768 }
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +0200769 else if( strcmp( p, "trunc_hmac" ) == 0 )
770 {
Manuel Pégourié-Gonnard265fe992015-01-09 12:43:35 +0100771 switch( atoi( q ) )
772 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200773 case 0: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_DISABLED; break;
774 case 1: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; break;
Manuel Pégourié-Gonnard265fe992015-01-09 12:43:35 +0100775 default: goto usage;
776 }
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +0200777 }
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +0200778 else if( strcmp( p, "hs_timeout" ) == 0 )
779 {
780 if( ( p = strchr( q, '-' ) ) == NULL )
781 goto usage;
782 *p++ = '\0';
783 opt.hs_to_min = atoi( q );
784 opt.hs_to_max = atoi( p );
785 if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min )
786 goto usage;
787 }
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +0100788 else if( strcmp( p, "recsplit" ) == 0 )
789 {
790 opt.recsplit = atoi( q );
791 if( opt.recsplit < 0 || opt.recsplit > 1 )
792 goto usage;
793 }
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +0200794 else if( strcmp( p, "dhmlen" ) == 0 )
795 {
796 opt.dhmlen = atoi( q );
797 if( opt.dhmlen < 0 )
798 goto usage;
799 }
Paul Bakker9caf2d22010-02-18 19:37:19 +0000800 else
801 goto usage;
802 }
Paul Bakker5121ce52009-01-03 21:22:43 +0000803
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200804#if defined(MBEDTLS_DEBUG_C)
805 mbedtls_debug_set_threshold( opt.debug_level );
Paul Bakkerc73079a2014-04-25 16:34:30 +0200806#endif
807
Paul Bakkerc1516be2013-06-29 16:01:32 +0200808 if( opt.force_ciphersuite[0] > 0 )
809 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200810 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
811 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( opt.force_ciphersuite[0] );
Paul Bakkerc1516be2013-06-29 16:01:32 +0200812
Paul Bakker66c48102013-07-26 14:05:32 +0200813 if( opt.max_version != -1 &&
814 ciphersuite_info->min_minor_ver > opt.max_version )
815 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200816 mbedtls_printf("forced ciphersuite not allowed with this protocol version\n");
Paul Bakker66c48102013-07-26 14:05:32 +0200817 ret = 2;
818 goto usage;
819 }
820 if( opt.min_version != -1 &&
Paul Bakkerc1516be2013-06-29 16:01:32 +0200821 ciphersuite_info->max_minor_ver < opt.min_version )
822 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200823 mbedtls_printf("forced ciphersuite not allowed with this protocol version\n");
Paul Bakkerc1516be2013-06-29 16:01:32 +0200824 ret = 2;
825 goto usage;
826 }
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +0100827
828 /* If the server selects a version that's not supported by
829 * this suite, then there will be no common ciphersuite... */
830 if( opt.max_version == -1 ||
831 opt.max_version > ciphersuite_info->max_minor_ver )
832 {
Paul Bakker66c48102013-07-26 14:05:32 +0200833 opt.max_version = ciphersuite_info->max_minor_ver;
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +0100834 }
Paul Bakker66c48102013-07-26 14:05:32 +0200835 if( opt.min_version < ciphersuite_info->min_minor_ver )
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +0100836 {
Paul Bakker66c48102013-07-26 14:05:32 +0200837 opt.min_version = ciphersuite_info->min_minor_ver;
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +0100838 /* DTLS starts with TLS 1.1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200839 if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
840 opt.min_version < MBEDTLS_SSL_MINOR_VERSION_2 )
841 opt.min_version = MBEDTLS_SSL_MINOR_VERSION_2;
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +0100842 }
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +0000843
844 /* Enable RC4 if needed and not explicitly disabled */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200845 if( ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +0000846 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200847 if( opt.arc4 == MBEDTLS_SSL_ARC4_DISABLED )
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +0000848 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200849 mbedtls_printf("forced RC4 ciphersuite with RC4 disabled\n");
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +0000850 ret = 2;
851 goto usage;
852 }
853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854 opt.arc4 = MBEDTLS_SSL_ARC4_ENABLED;
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +0000855 }
Paul Bakkerc1516be2013-06-29 16:01:32 +0200856 }
857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200858#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Paul Bakker5121ce52009-01-03 21:22:43 +0000859 /*
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200860 * Unhexify the pre-shared key if any is given
861 */
862 if( strlen( opt.psk ) )
863 {
864 unsigned char c;
865 size_t j;
866
867 if( strlen( opt.psk ) % 2 != 0 )
868 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200869 mbedtls_printf("pre-shared key not valid hex\n");
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200870 goto exit;
871 }
872
873 psk_len = strlen( opt.psk ) / 2;
874
875 for( j = 0; j < strlen( opt.psk ); j += 2 )
876 {
877 c = opt.psk[j];
878 if( c >= '0' && c <= '9' )
879 c -= '0';
880 else if( c >= 'a' && c <= 'f' )
881 c -= 'a' - 10;
882 else if( c >= 'A' && c <= 'F' )
883 c -= 'A' - 10;
884 else
885 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200886 mbedtls_printf("pre-shared key not valid hex\n");
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200887 goto exit;
888 }
889 psk[ j / 2 ] = c << 4;
890
891 c = opt.psk[j + 1];
892 if( c >= '0' && c <= '9' )
893 c -= '0';
894 else if( c >= 'a' && c <= 'f' )
895 c -= 'a' - 10;
896 else if( c >= 'A' && c <= 'F' )
897 c -= 'A' - 10;
898 else
899 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900 mbedtls_printf("pre-shared key not valid hex\n");
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200901 goto exit;
902 }
903 psk[ j / 2 ] |= c;
904 }
905 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200906#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200907
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200908#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200909 if( opt.alpn_string != NULL )
910 {
911 p = (char *) opt.alpn_string;
912 i = 0;
913
914 /* Leave room for a final NULL in alpn_list */
915 while( i < (int) sizeof alpn_list - 1 && *p != '\0' )
916 {
917 alpn_list[i++] = p;
918
919 /* Terminate the current string and move on to next one */
920 while( *p != ',' && *p != '\0' )
921 p++;
922 if( *p == ',' )
923 *p++ = '\0';
924 }
925 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200926#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +0200927
Paul Bakkerd4a56ec2013-04-16 18:05:29 +0200928 /*
Paul Bakker5121ce52009-01-03 21:22:43 +0000929 * 0. Initialize the RNG and the session data
930 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931 mbedtls_printf( "\n . Seeding the random number generator..." );
Paul Bakker508ad5a2011-12-04 17:09:26 +0000932 fflush( stdout );
933
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200934 mbedtls_entropy_init( &entropy );
Manuel Pégourié-Gonnardec160c02015-04-28 22:52:30 +0200935 if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
Paul Bakkeref3f8c72013-06-24 13:01:08 +0200936 (const unsigned char *) pers,
937 strlen( pers ) ) ) != 0 )
Paul Bakker508ad5a2011-12-04 17:09:26 +0000938 {
Manuel Pégourié-Gonnardec160c02015-04-28 22:52:30 +0200939 mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%x\n", -ret );
Paul Bakker508ad5a2011-12-04 17:09:26 +0000940 goto exit;
941 }
942
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200943 mbedtls_printf( " ok\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +0000944
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker5121ce52009-01-03 21:22:43 +0000946 /*
947 * 1.1. Load the trusted CA
948 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200949 mbedtls_printf( " . Loading the CA root certificate ..." );
Paul Bakker5121ce52009-01-03 21:22:43 +0000950 fflush( stdout );
951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200952#if defined(MBEDTLS_FS_IO)
Paul Bakker8d914582012-06-04 12:46:42 +0000953 if( strlen( opt.ca_path ) )
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +0100954 if( strcmp( opt.ca_path, "none" ) == 0 )
955 ret = 0;
956 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200957 ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path );
Paul Bakker8d914582012-06-04 12:46:42 +0000958 else if( strlen( opt.ca_file ) )
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +0100959 if( strcmp( opt.ca_file, "none" ) == 0 )
960 ret = 0;
961 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200962 ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file );
Paul Bakkered27a042013-04-18 22:46:23 +0200963 else
Paul Bakker5690efc2011-05-26 13:16:06 +0000964#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200965#if defined(MBEDTLS_CERTS_C)
966 for( i = 0; mbedtls_test_cas[i] != NULL; i++ )
Manuel Pégourié-Gonnard2f165062015-03-27 10:20:26 +0100967 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200968 ret = mbedtls_x509_crt_parse( &cacert,
969 (const unsigned char *) mbedtls_test_cas[i],
970 mbedtls_test_cas_len[i] );
Manuel Pégourié-Gonnard2f165062015-03-27 10:20:26 +0100971 if( ret != 0 )
972 break;
973 }
Paul Bakker5690efc2011-05-26 13:16:06 +0000974#else
975 {
976 ret = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200977 mbedtls_printf("MBEDTLS_CERTS_C not defined.");
Paul Bakker5690efc2011-05-26 13:16:06 +0000978 }
979#endif
Paul Bakker42488232012-05-16 08:21:05 +0000980 if( ret < 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +0000981 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200982 mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000983 goto exit;
984 }
985
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200986 mbedtls_printf( " ok (%d skipped)\n", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +0000987
988 /*
989 * 1.2. Load own certificate and private key
990 *
991 * (can be skipped if client authentication is not required)
992 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200993 mbedtls_printf( " . Loading the client cert. and key..." );
Paul Bakker5121ce52009-01-03 21:22:43 +0000994 fflush( stdout );
995
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200996#if defined(MBEDTLS_FS_IO)
Paul Bakker67968392010-07-18 08:28:20 +0000997 if( strlen( opt.crt_file ) )
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +0100998 if( strcmp( opt.crt_file, "none" ) == 0 )
999 ret = 0;
1000 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001001 ret = mbedtls_x509_crt_parse_file( &clicert, opt.crt_file );
Paul Bakkered27a042013-04-18 22:46:23 +02001002 else
Paul Bakker5690efc2011-05-26 13:16:06 +00001003#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001004#if defined(MBEDTLS_CERTS_C)
1005 ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) mbedtls_test_cli_crt,
1006 mbedtls_test_cli_crt_len );
Paul Bakker5690efc2011-05-26 13:16:06 +00001007#else
1008 {
1009 ret = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001010 mbedtls_printf("MBEDTLS_CERTS_C not defined.");
Paul Bakker5690efc2011-05-26 13:16:06 +00001011 }
1012#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001013 if( ret != 0 )
1014 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001015 mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001016 goto exit;
1017 }
1018
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001019#if defined(MBEDTLS_FS_IO)
Paul Bakker67968392010-07-18 08:28:20 +00001020 if( strlen( opt.key_file ) )
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001021 if( strcmp( opt.key_file, "none" ) == 0 )
1022 ret = 0;
1023 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001024 ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, "" );
Paul Bakker67968392010-07-18 08:28:20 +00001025 else
Paul Bakker5690efc2011-05-26 13:16:06 +00001026#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001027#if defined(MBEDTLS_CERTS_C)
1028 ret = mbedtls_pk_parse_key( &pkey, (const unsigned char *) mbedtls_test_cli_key,
1029 mbedtls_test_cli_key_len, NULL, 0 );
Paul Bakker5690efc2011-05-26 13:16:06 +00001030#else
1031 {
1032 ret = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033 mbedtls_printf("MBEDTLS_CERTS_C not defined.");
Paul Bakker5690efc2011-05-26 13:16:06 +00001034 }
1035#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001036 if( ret != 0 )
1037 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038 mbedtls_printf( " failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", -ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001039 goto exit;
1040 }
1041
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042 mbedtls_printf( " ok\n" );
1043#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001044
1045 /*
1046 * 2. Start the connection
1047 */
Manuel Pégourié-Gonnard0d8780b2014-02-25 11:11:26 +01001048 if( opt.server_addr == NULL)
1049 opt.server_addr = opt.server_name;
1050
Manuel Pégourié-Gonnardc0d74942015-06-23 12:30:57 +02001051 mbedtls_printf( " . Connecting to %s/%s/%s...",
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001052 opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? "tcp" : "udp",
Manuel Pégourié-Gonnard8a06d9c2014-03-23 18:23:41 +01001053 opt.server_addr, opt.server_port );
Paul Bakker5121ce52009-01-03 21:22:43 +00001054 fflush( stdout );
1055
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001056 if( ( ret = mbedtls_net_connect( &server_fd, opt.server_addr, opt.server_port,
1057 opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ?
1058 MBEDTLS_NET_PROTO_TCP : MBEDTLS_NET_PROTO_UDP ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001059 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060 mbedtls_printf( " failed\n ! mbedtls_net_connect returned -0x%x\n\n", -ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001061 goto exit;
1062 }
1063
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001064 if( opt.nbio > 0 )
Manuel Pégourié-Gonnard5db64322015-06-30 15:40:39 +02001065 ret = mbedtls_net_set_nonblock( &server_fd );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001066 else
Manuel Pégourié-Gonnard5db64322015-06-30 15:40:39 +02001067 ret = mbedtls_net_set_block( &server_fd );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001068 if( ret != 0 )
1069 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001070 mbedtls_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001071 goto exit;
1072 }
1073
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001074 mbedtls_printf( " ok\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001075
1076 /*
1077 * 3. Setup stuff
1078 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001079 mbedtls_printf( " . Setting up the SSL/TLS structure..." );
Paul Bakker5121ce52009-01-03 21:22:43 +00001080 fflush( stdout );
1081
Manuel Pégourié-Gonnard419d5ae2015-05-04 19:32:36 +02001082 if( ( ret = mbedtls_ssl_config_defaults( &conf,
1083 MBEDTLS_SSL_IS_CLIENT,
Manuel Pégourié-Gonnardb31c5f62015-06-17 13:53:47 +02001084 opt.transport,
1085 MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001086 {
1087 mbedtls_printf( " failed\n ! mbedtls_ssl_config_defaults returned -0x%x\n\n", -ret );
1088 goto exit;
1089 }
1090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001091#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker915275b2012-09-28 07:10:55 +00001092 if( opt.debug_level > 0 )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001093 mbedtls_ssl_conf_verify( &conf, my_verify, NULL );
Paul Bakkered27a042013-04-18 22:46:23 +02001094#endif
Paul Bakker915275b2012-09-28 07:10:55 +00001095
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001096 if( opt.auth_mode != DFL_AUTH_MODE )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001097 mbedtls_ssl_conf_authmode( &conf, opt.auth_mode );
Paul Bakker5121ce52009-01-03 21:22:43 +00001098
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001099#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +02001100 if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001101 mbedtls_ssl_conf_handshake_timeout( &conf, opt.hs_to_min, opt.hs_to_max );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001102#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardd823bd02014-10-01 14:40:56 +02001103
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001104#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001105 if( ( ret = mbedtls_ssl_conf_max_frag_len( &conf, opt.mfl_code ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001106 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001107 mbedtls_printf( " failed\n ! mbedtls_ssl_conf_max_frag_len returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001108 goto exit;
1109 }
Paul Bakker05decb22013-08-15 13:33:48 +02001110#endif
Manuel Pégourié-Gonnard0df6b1f2013-07-16 13:39:57 +02001111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001112#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard265fe992015-01-09 12:43:35 +01001113 if( opt.trunc_hmac != DFL_TRUNC_HMAC )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001114 mbedtls_ssl_conf_truncated_hmac( &conf, opt.trunc_hmac );
Paul Bakker1f2bc622013-08-15 13:45:55 +02001115#endif
Manuel Pégourié-Gonnarde980a992013-07-19 11:08:52 +02001116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001117#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001118 if( opt.extended_ms != DFL_EXTENDED_MS )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001119 mbedtls_ssl_conf_extended_master_secret( &conf, opt.extended_ms );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001120#endif
1121
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001122#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001123 if( opt.etm != DFL_ETM )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001124 mbedtls_ssl_conf_encrypt_then_mac( &conf, opt.etm );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001125#endif
1126
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001127#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01001128 if( opt.recsplit != DFL_RECSPLIT )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001129 mbedtls_ssl_conf_cbc_record_splitting( &conf, opt.recsplit
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001130 ? MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED
1131 : MBEDTLS_SSL_CBC_RECORD_SPLITTING_DISABLED );
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01001132#endif
1133
Manuel Pégourié-Gonnard90966822015-06-11 17:02:29 +02001134#if defined(MBEDTLS_DHM_C)
1135 if( opt.dhmlen != DFL_DHMLEN )
1136 mbedtls_ssl_conf_dhm_min_bitlen( &conf, opt.dhmlen );
1137#endif
1138
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001139#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001140 if( opt.alpn_string != NULL )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001141 if( ( ret = mbedtls_ssl_conf_alpn_protocols( &conf, alpn_list ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001142 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001143 mbedtls_printf( " failed\n ! mbedtls_ssl_conf_alpn_protocols returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001144 goto exit;
1145 }
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001146#endif
1147
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001148 mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
1149 mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
Manuel Pégourié-Gonnard55753162014-02-26 13:47:08 +01001150
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001151 mbedtls_ssl_conf_read_timeout( &conf, opt.read_timeout );
Paul Bakker5121ce52009-01-03 21:22:43 +00001152
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001153#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnardb596abf2015-05-20 10:45:29 +02001154 mbedtls_ssl_conf_session_tickets( &conf, opt.tickets );
Paul Bakkera503a632013-08-14 13:48:06 +02001155#endif
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02001156
Paul Bakker645ce3a2012-10-31 12:32:41 +00001157 if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001158 mbedtls_ssl_conf_ciphersuites( &conf, opt.force_ciphersuite );
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001159
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02001160#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnardd42b7c82015-03-20 19:44:04 +00001161 if( opt.arc4 != DFL_ARC4 )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001162 mbedtls_ssl_conf_arc4_support( &conf, opt.arc4 );
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +02001163#endif
Paul Bakker51936882011-02-20 16:05:58 +00001164
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001165 if( opt.allow_legacy != DFL_ALLOW_LEGACY )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001166 mbedtls_ssl_conf_legacy_renegotiation( &conf, opt.allow_legacy );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001167#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001168 mbedtls_ssl_conf_renegotiation( &conf, opt.renegotiation );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001169#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001171#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001172 if( strcmp( opt.ca_path, "none" ) != 0 &&
1173 strcmp( opt.ca_file, "none" ) != 0 )
1174 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001175 mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001176 }
1177 if( strcmp( opt.crt_file, "none" ) != 0 &&
1178 strcmp( opt.key_file, "none" ) != 0 )
1179 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001180 if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &clicert, &pkey ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001181 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001182 mbedtls_printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001183 goto exit;
1184 }
Manuel Pégourié-Gonnard3e1b1782014-02-27 13:35:00 +01001185 }
Paul Bakkered27a042013-04-18 22:46:23 +02001186#endif
1187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001188#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001189 if( ( ret = mbedtls_ssl_conf_psk( &conf, psk, psk_len,
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001190 (const unsigned char *) opt.psk_identity,
1191 strlen( opt.psk_identity ) ) ) != 0 )
1192 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001193 mbedtls_printf( " failed\n ! mbedtls_ssl_conf_psk returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001194 goto exit;
1195 }
Paul Bakkered27a042013-04-18 22:46:23 +02001196#endif
1197
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +02001198 if( opt.min_version != DFL_MIN_VERSION )
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001199 mbedtls_ssl_conf_min_version( &conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.min_version );
Manuel Pégourié-Gonnard864a81f2014-02-10 14:25:10 +01001200
Manuel Pégourié-Gonnard8c8be1e2015-03-31 14:21:11 +02001201 if( opt.max_version != DFL_MAX_VERSION )
Manuel Pégourié-Gonnard01e5e8c2015-05-11 10:11:56 +02001202 mbedtls_ssl_conf_max_version( &conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.max_version );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001205 if( opt.fallback != DFL_FALLBACK )
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001206 mbedtls_ssl_conf_fallback( &conf, opt.fallback );
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001207#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001208
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001209 if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
1210 {
1211 mbedtls_printf( " failed\n ! mbedtls_ssl_setup returned -0x%x\n\n", -ret );
1212 goto exit;
1213 }
1214
1215#if defined(MBEDTLS_X509_CRT_PARSE_C)
1216 if( ( ret = mbedtls_ssl_set_hostname( &ssl, opt.server_name ) ) != 0 )
1217 {
1218 mbedtls_printf( " failed\n ! mbedtls_ssl_set_hostname returned %d\n\n", ret );
1219 goto exit;
1220 }
1221#endif
1222
Manuel Pégourié-Gonnard70905a72015-09-16 11:08:34 +02001223#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1224 if( opt.ecjpake_pw != DFL_ECJPAKE_PW )
1225 {
1226 if( ( ret = mbedtls_ssl_set_hs_ecjpake_password( &ssl,
1227 (const unsigned char *) opt.ecjpake_pw,
1228 strlen( opt.ecjpake_pw ) ) ) != 0 )
1229 {
1230 mbedtls_printf( " failed\n ! mbedtls_ssl_set_hs_ecjpake_password returned %d\n\n", ret );
1231 goto exit;
1232 }
1233 }
1234#endif
1235
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001236 if( opt.nbio == 2 )
1237 mbedtls_ssl_set_bio( &ssl, &server_fd, my_send, my_recv, NULL );
1238 else
1239 mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv,
Manuel Pégourié-Gonnardd4f04db2015-05-14 18:58:17 +02001240 opt.nbio == 0 ? mbedtls_net_recv_timeout : NULL );
Manuel Pégourié-Gonnard06939ce2015-05-11 11:25:46 +02001241
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +02001242#if defined(MBEDTLS_TIMING_C)
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +02001243 mbedtls_ssl_set_timer_cb( &ssl, &timer, mbedtls_timing_set_delay,
1244 mbedtls_timing_get_delay );
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +02001245#endif
Manuel Pégourié-Gonnarde3c41ad2015-05-13 10:04:32 +02001246
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001247 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnard798f15a2014-03-26 18:12:04 +01001248
Paul Bakker5121ce52009-01-03 21:22:43 +00001249 /*
1250 * 4. Handshake
1251 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001252 mbedtls_printf( " . Performing the SSL/TLS handshake..." );
Paul Bakker5121ce52009-01-03 21:22:43 +00001253 fflush( stdout );
1254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001255 while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001256 {
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001257 if( ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE )
Paul Bakker40e46942009-01-03 21:51:57 +00001258 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001259 mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n", -ret );
1260 if( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED )
1261 mbedtls_printf(
Manuel Pégourié-Gonnardfcf2fc22014-03-11 11:10:27 +01001262 " Unable to verify the server's certificate. "
1263 "Either it is invalid,\n"
1264 " or you didn't set ca_file or ca_path "
1265 "to an appropriate value.\n"
1266 " Alternatively, you may want to use "
1267 "auth_mode=optional for testing purposes.\n" );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001268 mbedtls_printf( "\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001269 goto exit;
Paul Bakker40e46942009-01-03 21:51:57 +00001270 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001271 }
1272
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001273 mbedtls_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n",
1274 mbedtls_ssl_get_version( &ssl ), mbedtls_ssl_get_ciphersuite( &ssl ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001275
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001276 if( ( ret = mbedtls_ssl_get_record_expansion( &ssl ) ) >= 0 )
1277 mbedtls_printf( " [ Record expansion is %d ]\n", ret );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02001278 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001279 mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" );
Manuel Pégourié-Gonnard9b35f182014-10-14 17:47:31 +02001280
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001281#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1282 mbedtls_printf( " [ Maximum fragment length is %u ]\n",
1283 (unsigned int) mbedtls_ssl_get_max_frag_len( &ssl ) );
1284#endif
1285
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001286#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001287 if( opt.alpn_string != NULL )
1288 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001289 const char *alp = mbedtls_ssl_get_alpn_protocol( &ssl );
1290 mbedtls_printf( " [ Application Layer Protocol is %s ]\n",
Manuel Pégourié-Gonnard1bd22812014-04-05 14:34:07 +02001291 alp ? alp : "(none)" );
1292 }
1293#endif
1294
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001295 if( opt.reconnect != 0 )
1296 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001297 mbedtls_printf(" . Saving session for reuse..." );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001298 fflush( stdout );
1299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001300 if( ( ret = mbedtls_ssl_get_session( &ssl, &saved_session ) ) != 0 )
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001301 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001302 mbedtls_printf( " failed\n ! mbedtls_ssl_get_session returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001303 goto exit;
1304 }
1305
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001306 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001307 }
1308
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001309#if defined(MBEDTLS_X509_CRT_PARSE_C)
Paul Bakker5121ce52009-01-03 21:22:43 +00001310 /*
1311 * 5. Verify the server certificate
1312 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001313 mbedtls_printf( " . Verifying peer X.509 certificate..." );
Paul Bakker5121ce52009-01-03 21:22:43 +00001314
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001315 if( ( flags = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001316 {
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001317 char vrfy_buf[512];
1318
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001319 mbedtls_printf( " failed\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001320
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +02001321 mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", flags );
Paul Bakker5121ce52009-01-03 21:22:43 +00001322
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001323 mbedtls_printf( "%s\n", vrfy_buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00001324 }
1325 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001326 mbedtls_printf( " ok\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001327
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001328 if( mbedtls_ssl_get_peer_cert( &ssl ) != NULL )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001329 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001330 mbedtls_printf( " . Peer certificate information ...\n" );
1331 mbedtls_x509_crt_info( (char *) buf, sizeof( buf ) - 1, " ",
1332 mbedtls_ssl_get_peer_cert( &ssl ) );
1333 mbedtls_printf( "%s\n", buf );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02001334 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001335#endif /* MBEDTLS_X509_CRT_PARSE_C */
Paul Bakker5121ce52009-01-03 21:22:43 +00001336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001337#if defined(MBEDTLS_SSL_RENEGOTIATION)
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001338 if( opt.renegotiate )
Manuel Pégourié-Gonnard53b3e062013-10-29 18:16:38 +01001339 {
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001340 /*
1341 * Perform renegotiation (this must be done when the server is waiting
1342 * for input from our side).
1343 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001344 mbedtls_printf( " . Performing renegotiation..." );
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001345 fflush( stdout );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001346 while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 )
Manuel Pégourié-Gonnard53b3e062013-10-29 18:16:38 +01001347 {
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001348 if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
1349 ret != MBEDTLS_ERR_SSL_WANT_WRITE )
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001350 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001351 mbedtls_printf( " failed\n ! mbedtls_ssl_renegotiate returned %d\n\n", ret );
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001352 goto exit;
1353 }
Manuel Pégourié-Gonnard53b3e062013-10-29 18:16:38 +01001354 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001355 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnard53b3e062013-10-29 18:16:38 +01001356 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001357#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard53b3e062013-10-29 18:16:38 +01001358
Paul Bakker5121ce52009-01-03 21:22:43 +00001359 /*
1360 * 6. Write the GET request
1361 */
Manuel Pégourié-Gonnarde63582a2014-10-14 11:47:21 +02001362 retry_left = opt.max_resend;
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001363send_request:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001364 mbedtls_printf( " > Write to server:" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001365 fflush( stdout );
1366
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001367 len = mbedtls_snprintf( (char *) buf, sizeof(buf) - 1, GET_REQUEST,
Manuel Pégourié-Gonnarddcab2932014-08-14 17:47:17 +02001368 opt.request_page );
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001369 tail_len = (int) strlen( GET_REQUEST_END );
Manuel Pégourié-Gonnarddcab2932014-08-14 17:47:17 +02001370
1371 /* Add padding to GET request to reach opt.request_size in length */
1372 if( opt.request_size != DFL_REQUEST_SIZE &&
1373 len + tail_len < opt.request_size )
Paul Bakker93c32b22014-04-25 13:40:05 +02001374 {
Manuel Pégourié-Gonnarddcab2932014-08-14 17:47:17 +02001375 memset( buf + len, 'A', opt.request_size - len - tail_len );
1376 len += opt.request_size - len - tail_len;
Paul Bakker93c32b22014-04-25 13:40:05 +02001377 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001378
Manuel Pégourié-Gonnarddcab2932014-08-14 17:47:17 +02001379 strncpy( (char *) buf + len, GET_REQUEST_END, sizeof(buf) - len - 1 );
1380 len += tail_len;
1381
Manuel Pégourié-Gonnarddea29c52014-06-18 13:07:56 +02001382 /* Truncate if request size is smaller than the "natural" size */
1383 if( opt.request_size != DFL_REQUEST_SIZE &&
1384 len > opt.request_size )
1385 {
1386 len = opt.request_size;
1387
1388 /* Still end with \r\n unless that's really not possible */
1389 if( len >= 2 ) buf[len - 2] = '\r';
1390 if( len >= 1 ) buf[len - 1] = '\n';
1391 }
1392
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001393 if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Paul Bakker5121ce52009-01-03 21:22:43 +00001394 {
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001395 for( written = 0, frags = 0; written < len; written += ret, frags++ )
Paul Bakker5121ce52009-01-03 21:22:43 +00001396 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001397 while( ( ret = mbedtls_ssl_write( &ssl, buf + written, len - written ) )
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001398 <= 0 )
Manuel Pégourié-Gonnard787b6582013-07-16 15:43:17 +02001399 {
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001400 if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
1401 ret != MBEDTLS_ERR_SSL_WANT_WRITE )
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001402 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001403 mbedtls_printf( " failed\n ! mbedtls_ssl_write returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001404 goto exit;
1405 }
Manuel Pégourié-Gonnard787b6582013-07-16 15:43:17 +02001406 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001407 }
1408 }
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001409 else /* Not stream, so datagram */
1410 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001411 do ret = mbedtls_ssl_write( &ssl, buf, len );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001412 while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
1413 ret == MBEDTLS_ERR_SSL_WANT_WRITE );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001414
1415 if( ret < 0 )
1416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001417 mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret );
Manuel Pégourié-Gonnard2d87e412014-10-13 18:38:36 +02001418 goto exit;
1419 }
1420
1421 frags = 1;
1422 written = ret;
1423 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001424
Manuel Pégourié-Gonnard787b6582013-07-16 15:43:17 +02001425 buf[written] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001426 mbedtls_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf );
Paul Bakker5121ce52009-01-03 21:22:43 +00001427
1428 /*
1429 * 7. Read the HTTP response
1430 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001431 mbedtls_printf( " < Read from server:" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001432 fflush( stdout );
1433
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001434 /*
1435 * TLS and DTLS need different reading styles (stream vs datagram)
1436 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437 if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001438 {
1439 do
1440 {
1441 len = sizeof( buf ) - 1;
1442 memset( buf, 0, sizeof( buf ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001443 ret = mbedtls_ssl_read( &ssl, buf, len );
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001444
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001445 if( ret == MBEDTLS_ERR_SSL_WANT_READ ||
1446 ret == MBEDTLS_ERR_SSL_WANT_WRITE )
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001447 continue;
1448
1449 if( ret <= 0 )
1450 {
1451 switch( ret )
1452 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001453 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
1454 mbedtls_printf( " connection was closed gracefully\n" );
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001455 ret = 0;
1456 goto close_notify;
1457
1458 case 0:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001459 case MBEDTLS_ERR_NET_CONN_RESET:
1460 mbedtls_printf( " connection was reset by peer\n" );
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001461 ret = 0;
1462 goto reconnect;
1463
1464 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001465 mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret );
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001466 goto exit;
1467 }
1468 }
1469
1470 len = ret;
1471 buf[len] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001472 mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001473
1474 /* End of message should be detected according to the syntax of the
1475 * application protocol (eg HTTP), just use a dummy test here. */
1476 if( ret > 0 && buf[len-1] == '\n' )
1477 {
1478 ret = 0;
1479 break;
1480 }
1481 }
1482 while( 1 );
1483 }
1484 else /* Not stream, so datagram */
Paul Bakker5121ce52009-01-03 21:22:43 +00001485 {
1486 len = sizeof( buf ) - 1;
1487 memset( buf, 0, sizeof( buf ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001488
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001489 do ret = mbedtls_ssl_read( &ssl, buf, len );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001490 while( ret == MBEDTLS_ERR_SSL_WANT_READ ||
1491 ret == MBEDTLS_ERR_SSL_WANT_WRITE );
Paul Bakker5121ce52009-01-03 21:22:43 +00001492
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001493 if( ret <= 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001494 {
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001495 switch( ret )
1496 {
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001497 case MBEDTLS_ERR_SSL_TIMEOUT:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001498 mbedtls_printf( " timeout\n" );
Manuel Pégourié-Gonnarde63582a2014-10-14 11:47:21 +02001499 if( retry_left-- > 0 )
Manuel Pégourié-Gonnardf1e0df32014-10-02 14:02:32 +02001500 goto send_request;
1501 goto exit;
1502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001503 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
1504 mbedtls_printf( " connection was closed gracefully\n" );
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001505 ret = 0;
Manuel Pégourié-Gonnardf1388742014-08-19 16:14:36 +02001506 goto close_notify;
Paul Bakker5121ce52009-01-03 21:22:43 +00001507
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001508 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001509 mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", -ret );
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001510 goto exit;
1511 }
Paul Bakker5690efc2011-05-26 13:16:06 +00001512 }
1513
Paul Bakker5121ce52009-01-03 21:22:43 +00001514 len = ret;
Paul Bakker93c32b22014-04-25 13:40:05 +02001515 buf[len] = '\0';
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001516 mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf );
Manuel Pégourié-Gonnardae5050c2014-07-11 14:14:15 +02001517 ret = 0;
Paul Bakker5121ce52009-01-03 21:22:43 +00001518 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001519
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001520 /*
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +02001521 * 7b. Simulate hard reset and reconnect from same port?
1522 */
1523 if( opt.reconnect_hard != 0 )
1524 {
1525 opt.reconnect_hard = 0;
1526
1527 mbedtls_printf( " . Restarting connection from same port..." );
1528 fflush( stdout );
1529
1530 if( ( ret = mbedtls_ssl_session_reset( &ssl ) ) != 0 )
1531 {
1532 mbedtls_printf( " failed\n ! mbedtls_ssl_session_reset returned -0x%x\n\n", -ret );
1533 goto exit;
1534 }
1535
1536 while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
1537 {
1538 if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
1539 ret != MBEDTLS_ERR_SSL_WANT_WRITE )
1540 {
1541 mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
1542 goto exit;
1543 }
1544 }
1545
1546 mbedtls_printf( " ok\n" );
1547
1548 goto send_request;
1549 }
1550
1551 /*
1552 * 7c. Continue doing data exchanges?
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001553 */
1554 if( --opt.exchanges > 0 )
1555 goto send_request;
1556
1557 /*
Manuel Pégourié-Gonnardf1388742014-08-19 16:14:36 +02001558 * 8. Done, cleanly close the connection
1559 */
1560close_notify:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001561 mbedtls_printf( " . Closing the connection..." );
Manuel Pégourié-Gonnarddbd23072015-09-04 10:20:17 +02001562 fflush( stdout );
Manuel Pégourié-Gonnardf1388742014-08-19 16:14:36 +02001563
Manuel Pégourié-Gonnard994f8b52014-10-09 19:56:44 +02001564 /* No error checking, the connection might be closed already */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001565 do ret = mbedtls_ssl_close_notify( &ssl );
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001566 while( ret == MBEDTLS_ERR_SSL_WANT_WRITE );
Manuel Pégourié-Gonnard994f8b52014-10-09 19:56:44 +02001567 ret = 0;
Manuel Pégourié-Gonnardf1388742014-08-19 16:14:36 +02001568
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001569 mbedtls_printf( " done\n" );
Manuel Pégourié-Gonnardf1388742014-08-19 16:14:36 +02001570
1571 /*
1572 * 9. Reconnect?
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001573 */
1574reconnect:
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001575 if( opt.reconnect != 0 )
1576 {
Manuel Pégourié-Gonnardcf2e97e2013-08-02 15:04:36 +02001577 --opt.reconnect;
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001578
Manuel Pégourié-Gonnard3d7d00a2015-06-30 15:55:03 +02001579 mbedtls_net_free( &server_fd );
Manuel Pégourié-Gonnard6b0d2682014-03-25 11:24:43 +01001580
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +02001581#if defined(MBEDTLS_TIMING_C)
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001582 if( opt.reco_delay > 0 )
Manuel Pégourié-Gonnarda63bc942015-05-14 18:22:47 +02001583 mbedtls_net_usleep( 1000000 * opt.reco_delay );
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +02001584#endif
Manuel Pégourié-Gonnard38d1eba2013-08-23 10:44:29 +02001585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001586 mbedtls_printf( " . Reconnecting with saved session..." );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001587
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001588 if( ( ret = mbedtls_ssl_session_reset( &ssl ) ) != 0 )
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001589 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001590 mbedtls_printf( " failed\n ! mbedtls_ssl_session_reset returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001591 goto exit;
1592 }
1593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001594 if( ( ret = mbedtls_ssl_set_session( &ssl, &saved_session ) ) != 0 )
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001595 {
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +02001596 mbedtls_printf( " failed\n ! mbedtls_ssl_conf_session returned %d\n\n", ret );
Manuel Pégourié-Gonnardc5fd3912014-07-08 14:05:52 +02001597 goto exit;
1598 }
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001599
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001600 if( ( ret = mbedtls_net_connect( &server_fd, opt.server_addr, opt.server_port,
1601 opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ?
1602 MBEDTLS_NET_PROTO_TCP : MBEDTLS_NET_PROTO_UDP ) ) != 0 )
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001603 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001604 mbedtls_printf( " failed\n ! mbedtls_net_connect returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001605 goto exit;
1606 }
1607
Manuel Pégourié-Gonnard85beb302014-10-02 17:59:19 +02001608 if( opt.nbio > 0 )
Manuel Pégourié-Gonnard5db64322015-06-30 15:40:39 +02001609 ret = mbedtls_net_set_nonblock( &server_fd );
Manuel Pégourié-Gonnard85beb302014-10-02 17:59:19 +02001610 else
Manuel Pégourié-Gonnard5db64322015-06-30 15:40:39 +02001611 ret = mbedtls_net_set_block( &server_fd );
Manuel Pégourié-Gonnard85beb302014-10-02 17:59:19 +02001612 if( ret != 0 )
1613 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001614 mbedtls_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n",
Manuel Pégourié-Gonnard85beb302014-10-02 17:59:19 +02001615 -ret );
1616 goto exit;
1617 }
1618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001619 while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001620 {
Manuel Pégourié-Gonnard88369942015-05-06 16:19:31 +01001621 if( ret != MBEDTLS_ERR_SSL_WANT_READ &&
1622 ret != MBEDTLS_ERR_SSL_WANT_WRITE )
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001623 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001624 mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", -ret );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001625 goto exit;
1626 }
1627 }
1628
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001629 mbedtls_printf( " ok\n" );
Manuel Pégourié-Gonnardaaa1eab2013-07-30 13:43:43 +02001630
1631 goto send_request;
1632 }
1633
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001634 /*
1635 * Cleanup and exit
1636 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001637exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001638#ifdef MBEDTLS_ERROR_C
Paul Bakkera3d195c2011-11-27 21:07:34 +00001639 if( ret != 0 )
1640 {
1641 char error_buf[100];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001642 mbedtls_strerror( ret, error_buf, 100 );
1643 mbedtls_printf("Last error was: -0x%X - %s\n\n", -ret, error_buf );
Paul Bakkera3d195c2011-11-27 21:07:34 +00001644 }
1645#endif
1646
Manuel Pégourié-Gonnard3d7d00a2015-06-30 15:55:03 +02001647 mbedtls_net_free( &server_fd );
Manuel Pégourié-Gonnarde08660e2014-08-16 11:28:40 +02001648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001649#if defined(MBEDTLS_X509_CRT_PARSE_C)
1650 mbedtls_x509_crt_free( &clicert );
1651 mbedtls_x509_crt_free( &cacert );
1652 mbedtls_pk_free( &pkey );
Paul Bakkered27a042013-04-18 22:46:23 +02001653#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001654 mbedtls_ssl_session_free( &saved_session );
1655 mbedtls_ssl_free( &ssl );
Manuel Pégourié-Gonnarddef0bbe2015-05-04 14:56:36 +02001656 mbedtls_ssl_config_free( &conf );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001657 mbedtls_ctr_drbg_free( &ctr_drbg );
1658 mbedtls_entropy_free( &entropy );
Paul Bakker5121ce52009-01-03 21:22:43 +00001659
Paul Bakkercce9d772011-11-18 14:26:47 +00001660#if defined(_WIN32)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001661 mbedtls_printf( " + Press Enter to exit this program.\n" );
Paul Bakker5121ce52009-01-03 21:22:43 +00001662 fflush( stdout ); getchar();
1663#endif
1664
Paul Bakkerdbd79ca2013-07-24 16:28:35 +02001665 // Shell can not handle large exit numbers -> 1 for errors
1666 if( ret < 0 )
1667 ret = 1;
1668
Paul Bakker5121ce52009-01-03 21:22:43 +00001669 return( ret );
1670}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001671#endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C &&
1672 MBEDTLS_SSL_CLI_C && MBEDTLS_NET_C && MBEDTLS_RSA_C &&
Manuel Pégourié-Gonnardd2377e72015-05-13 13:58:56 +02001673 MBEDTLS_CTR_DRBG_C MBEDTLS_TIMING_C */